CVE-2026-31196 describes an OS command injection vulnerability in the traceroute diagnostic handler located in /bin/httpd_clientside on ALTICE LABS / SFR France GR140DG Fibre Routers with specific firmware versions. The issue is due to the insertion of unsanitized user input into a system() call, enabling authenticated remote attackers to execute arbitrary commands with root privileges by crafting the destAddr parameter using shell command substitution. The vulnerability is categorized under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). No official patch or remediation level has been provided as of the publication date.

Successful exploitation allows authenticated remote attackers to execute arbitrary commands as root on affected devices, potentially leading to full system compromise, data loss, or disruption of service. The vulnerability affects confidentiality, integrity, and availability with high impact as indicated by the CVSS score of 8.8.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the traceroute diagnostic functionality to trusted users only and monitor for suspicious activity involving the destAddr parameter. Avoid exposing the affected interface to untrusted networks.